This study proposes an unsupervised learning approach for anomaly detection in industrial control systems (ICSs). ICSs are critical for managing and monitoring industrial processes across various sectors, including manufacturing, energy, and water treatment. However, detecting anomalies in ICSs is challenging due to the complexity of their systems, the diversity of equipment from multiple vendors, and the need for continuous operation in limited environments. Traditional supervised learning methods require labeled datasets, which are time-consuming and require expertise to create. This study suggests an alternative approach using unsupervised machine learning to identify anomalous behavior in ICSs without the need for pre-labeled data. The study employs a composite autoencoder model to detect and classify anomalies. This model is trained on a dataset that utilizes HIL-augmented ICSs (HAIs), which are designed to simulate real-world industrial environments. The model is capable of accurately identifying important data characteristics and detecting anomalous patterns related to both value and time. The study also includes intentional error data injection experiments to validate the model's robustness in real-time monitoring and industrial process performance optimization. The proposed method involves data collection from multiple sensors and systems in an ICS environment, followed by data preprocessing, including normalization, dimensionality reduction using PCA, and clustering techniques. The data are then used to train a composite autoencoder model, which is evaluated on a separate dataset to validate its ability to detect anomalies. The model's performance is assessed using metrics such as accuracy, precision, recall, and F1 score. The results show that the model effectively detects anomalies in both single-variable and multivariate scenarios. The model's ability to detect anomalies in real-time can improve system reliability and operational efficiency, establishing a foundation for safe and sustainable ICS operations. The study contributes to the field of ICS anomaly detection by providing a data-driven approach that can adapt to different ICS environments without relying on pre-labeled data. This approach is particularly valuable in ICS environments where traditional data analytics frameworks may miss emerging security threats. The study also highlights the importance of proactive anomaly detection in ICSs to prevent potential damage and enhance security.This study proposes an unsupervised learning approach for anomaly detection in industrial control systems (ICSs). ICSs are critical for managing and monitoring industrial processes across various sectors, including manufacturing, energy, and water treatment. However, detecting anomalies in ICSs is challenging due to the complexity of their systems, the diversity of equipment from multiple vendors, and the need for continuous operation in limited environments. Traditional supervised learning methods require labeled datasets, which are time-consuming and require expertise to create. This study suggests an alternative approach using unsupervised machine learning to identify anomalous behavior in ICSs without the need for pre-labeled data. The study employs a composite autoencoder model to detect and classify anomalies. This model is trained on a dataset that utilizes HIL-augmented ICSs (HAIs), which are designed to simulate real-world industrial environments. The model is capable of accurately identifying important data characteristics and detecting anomalous patterns related to both value and time. The study also includes intentional error data injection experiments to validate the model's robustness in real-time monitoring and industrial process performance optimization. The proposed method involves data collection from multiple sensors and systems in an ICS environment, followed by data preprocessing, including normalization, dimensionality reduction using PCA, and clustering techniques. The data are then used to train a composite autoencoder model, which is evaluated on a separate dataset to validate its ability to detect anomalies. The model's performance is assessed using metrics such as accuracy, precision, recall, and F1 score. The results show that the model effectively detects anomalies in both single-variable and multivariate scenarios. The model's ability to detect anomalies in real-time can improve system reliability and operational efficiency, establishing a foundation for safe and sustainable ICS operations. The study contributes to the field of ICS anomaly detection by providing a data-driven approach that can adapt to different ICS environments without relying on pre-labeled data. This approach is particularly valuable in ICS environments where traditional data analytics frameworks may miss emerging security threats. The study also highlights the importance of proactive anomaly detection in ICSs to prevent potential damage and enhance security.